This policy explains how Kairo (“Kairo”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you visit our website, contact us, request a diagnostic, use Neo, or engage with our services. What Neo does with data from Google accounts you connect to it is described in section 2.
1. Information we collect
Information you provide. This may include your name, work email address, company or brand website, role, the growth constraint you select, and anything you include in communications with us.
Information related to an engagement. If you become a client or partner, we may process business contact details, account and access information, instructions, project communications, and other information necessary to deliver the agreed services. Engagement-specific data handling may also be governed by a separate agreement.
Technical information. Our hosting and security providers may automatically process standard network and device information, such as IP address, browser type, requested pages, timestamps, and diagnostic or security logs.
If you allow analytics, Google Analytics 4 receives website usage information such as pages viewed, browser and device information, approximate location and session activity. Google processes this information to provide our analytics reports. Google Tag Manager manages the analytics tag. Form answers and contact details are excluded from analytics, and advertising features are disabled. You can withdraw permission through “Cookie preferences” on any page.
2. Neo and Google user data
Neo is Kairo’s app at neo.gokairo.ai. A brand can connect a Gmail mailbox and a Google Analytics 4 property to Neo. This section explains what Neo does with information it receives from Google APIs (“Google user data”). Where it differs from the rest of this policy, this section governs Google user data.
What Neo reads from Gmail. With read-only Gmail access (gmail.readonly), Neo reads the messages and threads in the connected mailbox, starting with the last 90 days, and then checks for new messages about every 15 minutes. It skips spam, trash, drafts, and messages Gmail files under Promotions, Social, Updates and Forums. For each message, Neo reads the sender, recipients, subject, date, message identifiers, labels and text. For attachments, it records only the file name, type and size, and never downloads the file. Neo’s list of contacts is built from the names and email addresses in those messages. Neo does not access your Google Contacts.
What Neo sends through Gmail. With Gmail send access (gmail.send), Neo sends a reply from the connected mailbox only when a user writes that reply in Neo’s Inbox and chooses to send it. The reply goes to the conversation’s contact, in the same thread. Neo never archives, labels, marks as read or deletes a message, and does not create drafts in Gmail.
What Neo reads from Google Analytics. With read-only Analytics access (analytics.readonly), Neo lists the GA4 properties you can access so you can choose one. It then reads that property’s name, time zone, currency and custom dimensions, and runs reports on it: sessions, users, engagement, key events, add-to-carts, checkouts, purchases and revenue, by date, channel, source, medium, campaign, transaction, product, event, device and landing page. These reports are totals. Neo does not request identifiers for individual visitors. It reads the past year when a property is connected, then refreshes nightly.
How Neo uses Google user data. Neo uses Google user data only to provide and improve Neo’s features for the brand that connected the account. That means showing the mailbox’s customer conversations in Neo’s Inbox, matched to the brand’s Shopify customers with the same email address, so the team can read, annotate and answer them. It also means suggesting replies and answering questions in Ask Neo (see “AI features” below), and showing marketing performance reports. Neo does not use Google user data for advertising. It does not sell it, use it to assess creditworthiness or for lending, or use it to develop, improve or train generalised AI or machine-learning models.
AI features and DeepSeek. Neo uses the API of DeepSeek, an AI provider that processes data in the People’s Republic of China, for two features:
- Suggested replies. When a user opens a conversation in Neo’s Inbox in which the customer wrote last and no reply has been started, or clicks “Suggest again”, Neo sends DeepSeek the conversation’s last 30 messages with their times. It also sends the team’s notes on the conversation, the brand’s name, and the customer’s details in Neo: name, email address, phone number, address and orders. Neo shows the suggestion in the reply box. Nothing is sent until a person reviews it and chooses to send it.
- Ask Neo. When a user asks Ask Neo a question, Neo may send DeepSeek the names and email addresses of matching contacts and the dates and status of their conversations, but not message text. It may also send GA4 totals such as sessions, purchases and revenue by channel.
Neo sends this data to DeepSeek only to produce the suggestion or answer the user is viewing, and for no other purpose.
Who can see it and who it is shared with. Google user data is available to the members of the brand’s team in Neo. Kairo staff do not read a brand’s Gmail messages, except with the brand’s permission for specific messages (for example, to help with a support request), where needed for security purposes such as investigating abuse, or to comply with the law. Google user data is shared only with Amazon Web Services, which hosts Neo, and with DeepSeek as described above. We do not transfer it to anyone else, except where required by law. In a merger, acquisition or sale of Kairo’s assets, it would be transferred only with your prior consent.
Where it is stored and how it is protected. Neo stores Google user data in a database hosted by Amazon Web Services in Israel (Tel Aviv region). The database is encrypted at rest. The Google access tokens Neo holds are encrypted again within the database. Neo connects to Google and DeepSeek over encrypted (TLS) connections.
How long it is kept. Neo keeps what it has read from a mailbox or property until the brand removes that mailbox or property, or the brand’s store is deleted from Neo. If Neo is uninstalled from a Shopify store, that store’s data, including its Google user data, is deleted 30 days later. Suggested replies are cached for up to one day. Deleted data may remain in encrypted database backups for up to 7 days.
Disconnecting and deleting. In Neo’s Sources, each Gmail mailbox and Google Analytics property has two options:
- Disconnect deletes Neo’s Google access tokens, so Neo stops reading from Google and can no longer send from the mailbox. What Neo has already read is kept.
- Remove permanently deletes the mailbox or property and everything Neo read from it. For a mailbox, that means its messages, threads and contacts, the team’s Inbox notes and drafts on those conversations, and the links between those contacts and the brand’s customers. For a property, it means its reports. A record that the mailbox or property was removed is kept in Neo’s audit log.
You can also revoke Neo’s access at any time from your Google Account, at myaccount.google.com/connections. To delete your Neo account or all of a brand’s data, follow the steps in Data deletion requests.
Limited Use. Neo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. How we use information
We use personal information to:
- respond to enquiries and provide requested diagnostics or information;
- assess fit, prepare proposals, and manage client relationships;
- deliver, secure, maintain, and improve our website and services;
- understand how our website is used and diagnose technical problems;
- protect against abuse, fraud, and security threats;
- comply with legal obligations and enforce our agreements; and
- send relevant updates where you have asked to receive them or where permitted by law, with an option to opt out.
4. Legal bases
Where applicable law requires a legal basis, we rely on one or more of the following: your consent; steps taken at your request before entering a contract; performance of a contract; compliance with a legal obligation; and our legitimate interests in operating, protecting, and improving our business, provided those interests are not overridden by your rights.
5. How we share information
We do not sell personal information. We may share it with service providers that help us host the website, process forms, communicate, provide professional services, or operate our business. We may also share information with professional advisers, authorities where legally required, or parties involved in a merger, financing, reorganisation, or sale of all or part of the business.
Service providers are expected to process information for the services they provide to us and subject to appropriate obligations.
Google user data in Neo is shared only as described in section 2.
6. International transfers
Kairo and its providers may process information in countries other than the one where you live. Where required, we use appropriate safeguards for international transfers. You may contact us for more information about safeguards relevant to your information.
Neo is hosted in Israel. Its AI features send some data to DeepSeek, which processes it in the People’s Republic of China, as described in section 2.
7. Retention
We keep personal information only for as long as reasonably necessary for the purposes described above, including to respond to enquiries, maintain business records, meet contractual or legal obligations, resolve disputes, and protect our rights. Retention periods vary according to the type of information and the reason it is held. How long Neo keeps Google user data is set out in section 2.
8. Security
We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, or alteration. No system is completely secure, and we cannot guarantee absolute security. You can read more about our approach on the Trust & Security page.
9. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information, and to withdraw consent where processing is based on consent. You may also have the right to complain to a data protection authority.
To make a request, email hello@gokairo.ai. We may need to verify your identity and may retain limited information where required or permitted by law.
10. Data deletion requests
If you want Kairo to delete personal information associated with your use of our website, services, or a connected Meta or Facebook account, email data@gokairo.ai with the subject “Data deletion request”. Please include the email address or account identifier you used with Kairo so we can locate the relevant information. Do not send us passwords or access tokens.
After verifying your request, we will delete or de-identify the relevant personal information unless we are required or permitted to retain it for legal, security, fraud-prevention, dispute-resolution, or record-keeping purposes. We will confirm when the request has been completed or explain if any information must be retained.
11. Children
Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children through this website.
12. Other websites
Our website may link to third-party websites or services. Their privacy practices are governed by their own policies, and we are not responsible for those practices.
13. Changes to this policy
We may update this policy from time to time. We will post the revised version here and update the “Last updated” date. Where required, we will provide additional notice.
14. Contact us
For privacy questions or requests, contact Kairo at hello@gokairo.ai.